CVE-2012-5805

The CVE-2012-5805/5806 family concerns Zen Cart PayPal integration (IPN for CVE-5805; Payments Pro for CVE-5806). Both describe failure to verify that the server hostname matches a domain in the certificate’s Common Name or subjectAltName, enabling MITM spoofing with any valid certificate. Underl...

CVE-2012-5785

CVE-2012-5785 concerns Apache Axis2/Java where server hostname verification against the certificate CN/SubjectAltName is not performed, enabling MITM spoofing with any valid certificate. Connected documents confirm multiple IBM advisories and IBM BPM/TDI/IMS products affected by this Axis2 SSL is...

CVE-2012-5786

Apache CXF’s wsdl_first_https sample in versions before 2.7.0 fails to verify server hostname against the certificate’s CN/subjectAltName, enabling MITM spoofing with an arbitrary valid certificate. This is tied to the sample’s DN check bypass flag. Publicly documented impact is limited to the sa...

CVE-2012-5812

CVE-2012-5812 affects the ACRA library for Android, where hostname verification for SSL is not performed against the server certificate’s CN or subjectAltName. This allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary valid certificate. The vulnerability descriptio...

CVE-2012-5822

The CVE-2012-5822 issue lies in Zamboni’s contribution feature, which does not verify that the server hostname matches a domain name in the certificate’s CN or subjectAltName. This allows man-in-the-middle attackers to spoof SSL servers by presenting arbitrary valid certificates, related to the P...

CVE-2012-5808

CVE-2012-5808 – Zen Cart LinkPoint module vulnerability. The issue is that the LinkPoint module does not verify that the server hostname matches a domain name in the certificate’s CN or subjectAltName, enabling MITM attackers to spoof SSL servers using arbitrary valid certificates. Documented acr...

CVE-2012-5789

The CVE-2012-5789 entry affects the PayPal Payments Standard PHP Library prior to 20120427. The root cause is failure to verify that the server hostname matches the domain name in the certificate’s CN or subjectAltName, enabling MITM-style spoofing via an arbitrary valid certificate due to a disa...

CVE-2012-5824

CVE-2012-5824 affects Trillian 5.1.0.19: it does not verify the server hostname against the certificate's CN or subjectAltName, enabling MITM via an arbitrary valid certificate. CVSSv2 base score 5.8 (Medium). No fix/version details are provided in the supplied documents.

CVE-2012-5791

CVE-2012-5791 concerns PayPal Invoicing, where the SSL/TLS hostname verification is not performed against the certificate’s CN or subjectAltName. This allows MITM attackers to spoof SSL servers by presenting a valid certificate. The provided records describe the issue and its impact (partial conf...

CVE-2012-5783

Apache Commons HttpClient 3.x (as used in Amazon FPS Java SDK and related products) is affected by CVE-2012-5783: the code does not verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling potential MITM spoofing with arbitrary certificates. AIX advisories,...

CVE-2012-5817

Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, fails to verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling MITM spoofing with an arbitrary valid certificate. Impact is described as spoofing SSL s...

CVE-2012-5794

The vulnerability CVE-2012-5794 affects the MoneyBookers module in osCommerce, where hostname verification for SSL certificates is not performed against the CN or subjectAltName. This enables MITM-style spoofing of SSL servers using an arbitrary valid certificate. The connected documents do not p...

CVE-2012-5814

CVE-2012-5814 concerns Weberknecht, used in GitHub Gaug.es and related products, which does not verify that the server hostname matches a domain name in the X.509 certificate (CN/subjectAltName). This lack of hostname verification enables MITM attackers to spoof SSL servers by presenting arbitrar...

CVE-2012-5825

Tweepy , a Python library for interacting with the Twitter API, failed to verify that the server hostname matches a domain in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This is related to its use of the Python httplib library, which does not perform hostname ...

CVE-2012-5788

The PayPal IPN utility is vulnerable because it does not verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling MITM spoofing with any valid certificate via the PHP fsockopen-based connection. Affected component: PayPal IPN utility; underlying issue: miss...

CVE-2012-5780

CVE-2012-5780 affects the Amazon merchant SDK and results from a failure to verify that the server hostname matches the domain in the certificate’s CN/SAN. This allows MITM if an attacker can present an arbitrary valid certificate. The issue is described across multiple sources (NVD/NVD-derived r...

CVE-2012-5784

The CVE-2012-5784 issue concerns Apache Axis 1.4 and earlier, where the getCN/subjectAltName validation is missing, allowing MITM with arbitrary valid certificates. The flaw affects Axis-based components (e.g., PayPal-related integrations and JMS in ActiveMQ) and has led to multiple advisories (i...

[SECURITY] [DSA 2572-1] iceape security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2572-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst November 4, 2012 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2571-1] libproxy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2571-1 [email protected] http://www.debian.org/security/ Raphael Geissert November 04, 2012 http://www.debian.org/security/faq -...

CVE-2012-5170

Pebble (open-source weblog system) is vulnerable to an open redirect in versions prior to 2.6.4. The flaw allows remote attackers to redirect users to arbitrary external websites, enabling phishing attacks via unspecified vectors. Affected product: Pebble; affected versions: before 2.6.4. Root ca...